Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The vendor confirmed early: "These issues were previously submitted by the researcher through our Security Response Center platform and are tracked internally as follows: Submission 990504 corresponds to our internal ticket #616 (Go2 chat_go WSS client disabled TLS server certificate validation, CWE-295)."
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.
Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.
@sxm-web/client-sdk-core is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version (0.0.1, 1.0.0, 1.0.1, 2.0.0, 1.1.0, 3.0.0, 13.3.7) has a postinstall script that runs `node beacon.cjs` on npm install, and index.js calls the same code when the package is imported; it POSTs the hostname, install path and current working directory over plain HTTP to `http://185.158.107.175:8787/_ah/dc`, and index.js exports a Proxy that returns no-op functions so builds importing the real package keep running. The npm account wiseke published 14 such packages under the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes between 2026-10-23 21:23 and 2026-10-25 14:28 UTC; index.js is byte-identical to that of ph-common (MAL-2026-1809), which sends to the same endpoint.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (8d53280e50e3f0ad06e3ab6e3685856cd774465fd6d4461d64e22caad4ee94fc)
@sxm-web/client-sdk-core@1.0.1 is a stub package whose only functional code is a beacon. The declared postinstall script runs `node beacon.cjs`, and the same beacon is also invoked at require time from index.js. The beacon collects installer-side identifiers (hostname, install path, current working directory, Node.js version, package name) and POSTs them in cleartext over plain HTTP to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc, which is unrelated to any legitimate registry or publisher infrastructure. The package's `main` returns a Proxy that produces no-op functions for every accessed property, so the package provides no advertised functionality — the install itself is the payload. The scoped name `@sxm-web/client-sdk-core` combined with a `Compatibility shim` description is consistent with a dependency-confusion probe aimed at an internal/private SDK namespace, where the beacon's purpose is to confirm successful resolution against private names and to disclose the resolving host's identity and filesystem layout to the operator at the bare IP.
## Source: ghsa-malware (8a5670fe68642a259935664dbac1c7c569c1af0b09253570a72909b92c7ac1c5)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation. Re-enabling promptvars, running set -o posix, or starting an interactive child bash that inherits the exported PS1 can then expand command substitution in the stored VIRTUAL_ENV_PROMPT value and execute commands as the user who activates the environment. This issue is fixed in version 21.14.13.
CVE-2026-106071 is a low-severity vulnerability affecting specific Ubuntu-distributed versions of Node.js. The vulnerability has a CVSS 3.0 base score of 3.6, indicating limited impact primarily on confidentiality and integrity with no impact on availability. The exact nature of the vulnerability is unknown due to lack of descriptive details. No public exploits or known active exploitation have been reported. The affected versions are specific Ubuntu package builds of Node.js versions 18.13.0, 18.19.1, and 20.19.4.
CVE-2026-105482 is a high severity vulnerability affecting specific Ubuntu-distributed versions of Node.js. The vulnerability has a CVSS 3.0 score of 7.4, indicating a network attack vector with high impact on confidentiality and integrity but requiring high attack complexity and no privileges or user interaction. The exact nature of the vulnerability is unknown as no detailed description or technical details are provided. No known exploits in the wild have been reported. The affected versions are specific Ubuntu package builds of Node.js versions 18.13.0, 18.19.1, and 20.19.4. No patch or remediation information is available, and the patch status is not confirmed.
obsidian-tc versions from 1.13.0 up to but not including 1.31.4 contain an improper authorization vulnerability. This flaw allows a client to bypass human approval for certain destructive vault operations when using Streamable HTTP deployment with auth.jwtSecret configured and a client supporting elicitation.form. The server incorrectly trusts a previously minted requestState as proof of approval, enabling execution of dispatch-gated destructive actions without explicit human consent. The issue is fixed in version 1.31.4.
CVE-2026-112847 is a critical vulnerability in ThemeREX ZenSoul up to version 1.13 that allows deserialization of untrusted data, leading to object injection. This flaw can be exploited remotely without authentication and results in full confidentiality, integrity, and availability compromise.
A vulnerability in the Linux kernel's packet_rcv_spkt() function could cause a kernel panic when processing packets on devices without a visible link layer header, such as CAN interfaces. This occurs because the function attempts to restore the link layer header without verifying its presence, leading to an invalid memory operation and system crash. The issue affects Linux kernel versions 5.9.13 through 5.10. The flaw has been fixed in Linux kernel version 5.10 and later.
CVE-2026-98996 is a Linux kernel vulnerability where the system may silently unmount busy mounts during propagation, causing mounts still in use to be detached. This occurs due to propagate_mount_busy() not properly checking references on certain mount copies, allowing synchronous unmounts to succeed incorrectly. The issue affects multiple Linux kernel versions from 4.1.43 up to and including 4.13. The vulnerability has been fixed in Linux kernel versions 4.2, 4.5, 4.10, 4.12, and 4.13.
A concurrency issue in the Linux kernel's cxgb4/ch_ktls component was fixed by disabling softirqs around tid_list erases. The flaw involved improper locking when erasing entries from a shared XArray, which could lead to deadlocks due to softirq interruptions during cleanup. The issue affects specific Linux kernel versions prior to 5.11, between 5.12.9 and 5.13, and version 5.13 itself.
CVE-2026-98964 is a high-severity vulnerability in the Linux kernel's nvmet subsystem. It involves improper handling of the local peer-to-peer (P2P) device pointer during metadata allocation failure, which can lead to incorrect cleanup operations. This flaw was fixed in Linux kernel version 5.13 and other specified commits.
A memory management issue in the Linux kernel's btrfs subsystem was fixed where the function btrfs_uring_read_extent() failed to free allocated iov memory on error paths except for a specific deferred case. This could lead to a memory leak. The issue affects Linux kernel version 6.13 and has been corrected in subsequent commits.
CVE-2026-98959 is a critical vulnerability in the Linux kernel's Btrfs filesystem related to extended attribute (xattr) handling. When multiple xattrs are packed in the same btrfs_dir_item and one xattr is replaced with a value of a different size, the kernel fails to fully initialize the new btrfs_dir_item. This causes filesystem corruption detected during extent buffer writeback, leading to transaction aborts and potential data loss. The issue occurs because the deletion and insertion of xattr items shift data in the leaf, leaving parts uninitialized. The vulnerability affects multiple Linux kernel versions prior to 3.11, 3.13, 3.15, and 3.19, with fixes applied in those versions. The CVSS 3.1 score is 9.8, indicating critical severity.